Rude Password, Weak Defences: How Legacy Servers Undid a Factory's Post-Breach Clean-Up

The Register's PWNED series shares cautionary tales from organisations that left the door open to attackers. This week's story comes from red teamer and pen tester Dahvid Schloss of Suzu Labs. A factory client had been hacked six months earlier, made some changes, and wanted proof it was now secure. Schloss's goal was to gain domain admin rights.

On site, he noticed Windows 7 servers connected to CNC milling machines, even though Windows 10 was by then Microsoft's supported desktop system. Such legacy systems are common where proprietary software could break after an upgrade. Most of these servers had been disconnected from the domain, which Schloss called the right move. Even on a vulnerable device, the local admin credentials differed from those on most workstations, so he could not get far.

Then he found a server attached to the milling machines that was both on the domain and vulnerable to EternalBlue. After dumping credentials from the LSASS service, he found two sets of credentials, one that looked like an admin account. Its password was a rude message to hackers written in leet speak. Although the string was technically strong, Schloss assumed the admins had planted it as a joke and that it would not work, so he sat on it for a week. The source excerpt ends there, so the outcome is not covered here.